Decoding SRTCP Packets
Hello,I am trying to decode SRTCP packets. I have the private key and specified it at Edit -> Preferences -> Protocols -> SSL. My SIP and RTP packets are decoding fine, but my RTCP packets are...
View ArticleDecoding tls1.2
I am not seeing any decoded application data. I am running wireshark 2.4 on the web server box, I have the private key in .pem formatI have the server private key listed in the RSA keys listI have the...
View ArticleSSL Decryption with tshark in PowerShell
Hi allI'm trying to automate the decryption of a trace with PowerShell and tshark. I have something like this:$SSLOptions=" -o ssl.desegment_ssl_records:TRUE -o ssl.desegment_ssl_application_data:TRUE...
View ArticleDecrypting a WCF response
Hi all,What would be the possible reasons for wireshark not showing a decrypted WCF response? I have successfully decrypted the request information from a WCF service for dummies, but can't get the...
View ArticleDescrypting a WCF response
Hi all,What would be the possible reasons for wireshark not showing a decrypted WCF response? I have successfully decrypted the request information from a WCF service for dummies, but can't get the...
View ArticlePort-mirror of SSL Handshake Packet Out-of-Order
This is actually more of a question of port-mirroring instead of Wireshark, but anyway, want to see if any one here has any thought on this.We have port-mirroring done in our client site, however all...
View ArticleSSL traffic decryption issue
Hello Sharkers :DSome time we need to investigate SSL traffic on some servers, we do have the SSL certificate for that server but the issue is after trying to decrypt the captured PCAP we are not able...
View ArticleServer Certificate packet format
I can't find a writeup on the format of the Server Certificate - i.e. what all the bytes are and the different variations. I have a couple of TLS/SSL books and papers, but they don't have anything on...
View ArticleDecrypt Secure Web Socket traffic not working
Hello,I'm trying to decrypt WSS (websocket secure) traffic in in Wireshark, but for some reason I cannot make it work. Here are the steps I followed:Collect all WSS traffic towards my server with...
View ArticleApplication Data Packet still doesn't decrypted even if correct SSL keys are...
When I looked at the packet content windows, the application layer shows Encrypted application data: <gibberish string>.I did try to check/uncheck the two settings there when importing the ssl...
View ArticleHow to find out which SSL cipher suite is being used?
I am using an app which says it uses ssl v3 to transporrt data. After running an ssl test I see that the server supports tls 1.1,1.2 and ssl v3 so I open Wirehsark and connect iphone with it by rvi...
View Articlessl continuation data?
hello,can someone please help me understand what 'continuation data' in 'Info' column means? protocol was SSL.thank you
View Articletrying to decode TLS
I'm trying to decrypt some TLS data that is coming to one of my local applications. From my research it seems like i'm supposed to set an SSLKEYLOGFILE environment variable and then point wireshark SSL...
View ArticleDecrypting website accessed through internet explorer
First of all apologies if the following question is unclear as I am unfamiliar with network security.I can view tabular data on a website after logging into my account. The website has TLS encryption...
View ArticleDecrypt SSL traffic from Android Device (Emulator)
I'm using an Android Emulator and logging into some apps (while running WireShark), and I now trying to figure out how to decrypt the SSL traffic.I understand that I need to find some sort of key to...
View Articleuse tshark with SSLKEYLOGFILE to get decrypted tls data
Hello, i am trying to use tshark from the command line to get unecrypted TLS packets. I want to do this with the SSLKEYLOGFILE of session keys like you would do through the wireshark interface. Does...
View Articleis the decryption of TLS_RSA_WITH_AES_256_GCM_SHA384 cipher suite supported?
I'm unable to decrypt any TLS 1.2 traffic if the cipher suite is TLS_RSA_WITH_AES_256_GCM_SHA384. I'm able to decrypt if I change the cipher suite. I'm using wireshark 2.2.6Wireshark SSL debug log...
View ArticleDecrypt SSL Packets using PyShark
I am able to decrypt SSL packets using wireshark as I have master key, but i am not able to do the same using PyShark. How to decrypt SSL Packets using PyShark?
View ArticleHow to decrypt ssl packet with tshark 1.8
I have tried to decrypt https traffic with tshark. The command that I used was as below:tshark -r 1.pcap -o ssl.keys_list:"10.140.8.27","443","http","test_ca.pem" -o ssl.debug_file:"ssldebug.log" -VThe...
View ArticleHow can I retrieve (full) urls from a tcp dump?
Dear allI want to check the URLs, which are opened from inside my private network in order to check if anything is requested that shouldn't be. As some of the URLs seem to be opened via https, tcpdump...
View Article
